axios CVE-2026-67312

Exploitation requires three concurrent conditions. First, the target application must use axios version 0.28.0 or later in either the 0.x or 1.x line (formDataToJSON did not exist before 0.28.0). Second, the application must process a request that causes axios to invoke formDataToJSON - this happens either via direct calls to axios.formToJSON(formData) or via axios's default transformRequest when a request body is a FormData object and the Content-Type header contains 'application/json'. Normal multipart FormData submission (without JSON serialisation) is not affected. Third, the attacker must control the FormData field names - not merely the values - that are passed through this path. Exploitation is limited by the AT:P condition in the CVSS 4.0 vector: not all axios deployments expose this code path. Applications that use axios exclusively for outbound HTTP calls with developer-controlled payloads, or that submit FormData as standard multipart without JSON serialisation, are not affected.

The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L) scores 6.3 and accurately represents the risk profile: network-reachable, no authentication required, but constrained by a specific attack precondition (AT:P) - the application must expose an endpoint that processes attacker-controlled FormData with JSON serialisation. The availability impact is scored Low (VA:L) at the vulnerable-system level, reflecting that the crash is catchable in well-written applications, though process termination is possible in poorly handled ones. No EPSS score was provided in the input, so exploitation probability cannot be quantified from that signal. There is no CISA KEV listing, confirming no observed active exploitation at time of analysis. The GHSA advisory provides precise technical detail (exact file, function, and payload structure), which significantly lowers the barrier for exploitation even without a published proof-of-concept. The real-world impact depends heavily on application architecture: a single-threaded Node.js server hit repeatedly would be fully disabled; a clustered or serverless deployment would absorb individual crashes more gracefully. This is a genuine priority for any team that processes user-supplied form field names through axios's JSON serialisation path, but not a broad emergency for applications using axios only for outbound API calls or standard multipart form submission.

An attacker submits an HTTP request to a Node.js API endpoint that accepts FormData and forwards it through axios with Content-Type: application/json - for example, a file-upload proxy or a form-parsing middleware. The attacker crafts a field name consisting of thousands of bracket-delimited segments (e.g., a[b][c]...[z] repeated thousands of times). When axios calls formDataToJSON internally, buildPath() recurses once per segment, exhausting the V8 call stack and throwing an uncaught RangeError that terminates the Node.js worker process, making the service unavailable to all concurrent users. No GHSA-published proof-of-concept was identified, but the advisory provides enough detail that the payload is trivially constructable.